to achieve interoperability (22.9%), for regulatory compliance
(18.3%), for certification purposes (14.5%) and for compliance
with public tendering (14.5%) [9].
Policy makers, regulatory agencies and the industry are also in-
creasingly agreeing that a baseline for IoT security is required
to ensure data protection, service continuity and public safety
[10–13]. Yet, given the diversity of IoT application areas and
domains, what this security baseline should include and how
it should be implemented and monitored, is still a matter for
debate.
1.1 Scope of the Paper
This paper provides a review of the main trends in the develop-
ment and evolution of IoT security standards to date. It aims to
offer a detailed analysis of the extent to which standardisation
efforts are leading towards the establishment of a baseline for
IoT security in some of the most developed IoT markets [2],
with particular focus on the UK, EU and US. Standards are
defined here broadly to include principles, guidelines, codes of
practice and technical specifications that are developed by pub-
lic, private and not-for-profit entities, including government
departments and agencies, national standardisation bodies, in-
dustry alliances and associations1.
Although the paper makes reference to some of the key IoT
security standards for specific domains, such as connected
autonomous vehicles, medical devices and industrial applica-
tions, it does not provide a comprehensive review of standards
for each IoT application area. Instead, it focuses on what in-
dustry and the public sector have currently identified as tech-
nical and organisational specifications for default IoT security.
1.2 Methodology
This paper summarises findings of an ongoing study conducted
by the Standards, Governance and Policy (SGP) team of the
PETRAS IoT Research Hub, which examines the dynamics
between voluntary standards and mandatory regulatory frame-
works for ensuring the adoption of a baseline of IoT security.
The research is underpinned by methodological triangulation
based upon:
1. Desk-based research of IoT security guidelines, codes of
practice and technical specifications, developed by public,
private and not-for-profit organisations;
2. An online ‘Cybersecurity of the Internet of Things Stan-
dards Survey’, exploring the use and implementation of
1This broad definition is adopted because technical (or design) specifica-
tions represent only one type of standards, which generally address behaviour
at the prevention stage. As outlined in the specialist literature, standards can
also focus on “the act that gives rise to a harmful result” – known as perfor-
mance standards, such as risk assessment in the context of cybersecurity, or
they can focus on “the harmful result itself” – known as target standards, such
as joint incident responses conducted by CERTs. For a foundational descrip-
tion of standards typologies, see Baldwin et al [14].
IoT security standards, conducted by PETRAS IoT, BSI
and IoTUK (March 2017);
3. A workshop on ‘IoT Security by Default’ with PETRAS
IoT researchers and partners, exploring standards devel-
opment in IoT consumer goods, transport, health, and
utilities (March 2017).
A fourth stage, consisting of a series of semi-structured inter-
views with key standards development organisations, trade as-
sociations and UK regulatory bodies, is currently being con-
ducted in order to gather more evidence on the barriers to the
adoption and implementation of IoT security standards.
1.3 Key Findings
This paper puts forward the following findings, as discussed in
the sections below:
1. While the policy and regulatory status quo is still based
on a ‘light touch’ approach to standardising IoT security,
governments and regulatory agencies in the EU and the
US are increasingly considering the promotion of base-
line IoT security requirements, achieved through public
procurement obligations and cybersecurity certification
schemes.
2. This policy shift can be seen as a response to the slow
pace of IoT security self-regulation achieved by the mar-
ket. Specifically, the IoT security standards landscape
is dominated by de facto standards, developed by a di-
verse range of industry alliances and associations across
the IoT ecosystem. Although there is some degree of con-
vergence towards baseline specifications for IoT security
across these schemes, there is also considerable competi-
tion between them, evident in the parallel development of
industry-led testing and certification schemes.
3. Two main gaps in the development of a commonly agreed
baseline for IoT security can be identified. First, there
is clear divergence across the reviewed standards on
the basic scope and relationship between IoT security,
safety, consumer trust, trustworthiness and system in-
tegrity. Second, at present, there is limited information
about the adoption, implementation and review rate of
government and industry-led standards for IoT security,
which makes their effectiveness difficult to monitor and
evaluate.
2 Policies, Regulatory Frameworks and
High-Level Guidelines for IoT Security
The policy landscape for IoT security is currently mixed, espe-
cially across the three regions that are estimated to “represent
67% of the overall IoT installed base in 2017” – Western Eu-
rope, North America and East Asia [2]. Over the past years,
governments and regulatory agencies across these regions have
2
